aboutsummaryrefslogtreecommitdiff
path: root/include
diff options
context:
space:
mode:
authorAndy Lutomirski2012-07-05 11:23:24 -0700
committerJames Morris2012-07-08 00:25:48 +1000
commitc540521bba5d2f24bd2c0417157bfaf8b85e2eee (patch)
tree64d387e5910f377b178bb168659684a0f09b20c2 /include
parent26c439d4005d94b8da28e023e285fd4a9943470e (diff)
security: Minor improvements to no_new_privs documentation
The documentation didn't actually mention how to enable no_new_privs. This also adds a note about possible interactions between no_new_privs and LSMs (i.e. why teaching systemd to set no_new_privs is not necessarily a good idea), and it references the new docs from include/linux/prctl.h. Suggested-by: Rob Landley <rob@landley.net> Signed-off-by: Andy Lutomirski <luto@amacapital.net> Acked-by: Kees Cook <keescook@chromium.org> Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'include')
-rw-r--r--include/linux/prctl.h2
1 files changed, 2 insertions, 0 deletions
diff --git a/include/linux/prctl.h b/include/linux/prctl.h
index 3988012255dc..289760f424aa 100644
--- a/include/linux/prctl.h
+++ b/include/linux/prctl.h
@@ -141,6 +141,8 @@
* Changing LSM security domain is considered a new privilege. So, for example,
* asking selinux for a specific new context (e.g. with runcon) will result
* in execve returning -EPERM.
+ *
+ * See Documentation/prctl/no_new_privs.txt for more details.
*/
#define PR_SET_NO_NEW_PRIVS 38
#define PR_GET_NO_NEW_PRIVS 39